PhyCloak: Obfuscating Sensing from Communication Signals

Transcription

1 PhyCloak: Obfuscating Sensing from Communication Signals Yue Qiao, Ouyang Zhang, Wenjie Zhou, Kannan Srinivasan, and Anish Arora, The Ohio State University This paper is included in the Proceedings of the 3th USENIX Symposium on Networked Systems Design and Implementation (NSDI 6). March 6 8, 26 Santa Clara, CA, USA ISBN Open access to the Proceedings of the 3th USENIX Symposium on Networked Systems Design and Implementation (NSDI 6) is sponsored by USENIX.

2 PhyCloak: Obfuscating Sensing from Communication Signals Yue Qiao, Ouyang Zhang, Wenjie Zhou, Kannan Srinivasan and Anish Arora Department of Computer Science and Engineering The Ohio State University {qiaoyu, zhouwe, kannan, ABSTRACT Recognition of human activities and gestures using preexisting WiFi signals has been shown to be feasible in recent studies. Given the pervasiveness of WiFi signals, this emerging sort of sensing poses a serious privacy threat. This paper is the first to counter the threat of unwanted or even malicious communication based sensing: it proposes a blackbox sensor obfuscation technique PhyCloak which distorts only the physical information in the communication signal that leaks privacy. The data in the communication signal is preserved and, in fact, the throughput of the link is increased with careful design. Moreover, the design allows coupling of the Phy- Cloak module with legitimate sensors, so that their sensing is preserved, while that of illegitimate sensors is obfuscated. The effectiveness of the design is validated via a prototype implementation on an SDR platform. Introduction A new form of threat has emerged recently that leaks private information about the whereabouts and activities of physical targets merely by observing the ongoing wireless communications in the scene. Broadly speaking, as a wireless signal gets reflected off of people and other objects in the scene, information about them is leaked to eavesdroppers by computational analysis of the signal distortions. Increasingly, researchers have been demonstrating proofs of concept where not only people presence but also fine-grain information about their locations and even breathing, lip movement or keystrokes is leaked [8, 28, 3,, 24] all from observing communication signals that are widely prevalent in our homes. While the upside is that legitimate users can detect these physical signatures simply using existing signals, a burglar can also detect that there are no people in a house, a passerby can decipher key presses without leaving a trace [8], and a neighbor can snoop on the activities in our homes [3]. There is little doubt that several of these privacy exploits will in due course be realized robustly and commoditized for broad use. And, given the pervasive nature of wireless communications, the privacy implications of such attacks will undoubtedly be of major social importance. It is thus timely and important to develop suitable counter-measures for this type of privacy leakage. We take the first step at tackling this problem by proposing a solution to address a single-antenna eavesdropping sensor. At first glance, it might appear that an obvious way to prevent or deter the privacy leakage is to simply jam the signals [2, ]. However, jamming is an overkill for this problem, as the protection we wish lies in physical and not in the logical (data) layer. Jamming distorts the information of both layers, therefore it hurts the channel capacity of the network. In contrast to jamming, our approach is to distort the physical information that is environmentally superimposed on the signal as opposed to the data itself. To make clear the distinction between these two forms of signal distortion, we refer to the latter as signal obfuscation. To avoid any modification of existing receivers, we need to build an obfuscator (Ox) that works independently from a receiver (Rx) and can yet deter privacy leakage against a single-antenna eavesdropper. At the same time, Ox should not hurt the ongoing reception at the intended receiver. In addition, given the diversity of the design of RF based sensors and invisibility of eavesdroppers, it is not reasonable to assume Ox that uses a specific obfuscation approach against a specific Eve. Thus, our goal is to build a black-box solution which distorts only the privacy sensitive information while not affecting the logical information. We design Ox by answering the two questions below:. How to distort physical information regardless of the RF-sensing mechanism? To answer this question, let us first examine what kind of physical information is contained in RF signals. Assume the received signal at a reflector is s(t), then the received signal r(t) USENIX Association 3th USENIX Symposium on Networked Systems Design and Implementation (NSDI 6) 685

3 reflected by the reflector can be expressed as follow: r(t) =a s(t) e j2π( f c+δ f )(t+δt), where a is the amplitude gain, f c is the carrier frequency, Δ f is the Doppler shift caused by a reflector that moves at a constant speed relative to the receiver, and Δt is the delay due to transmission over the path. Here, we can see that the reflector modifies the reflected copies by controlling three orthogonal components: amplitude gain a, delay Δt and Doppler shift Δ f. All the features exploited by singleantenna RF based sensors are created by these three degrees of freedom (DoFs). Hence, if an Ox distorts the three orthogonal bases respectively, any features that reveal physical information are distorted too. 2. How to preserve logical information (data communication)? As the previous observation suggests, Ox needs to change the 3 degrees of freedom (DoFs) of a signal in order to deter eavesdropping of physically sensed features. Note that in a wireless environment, signals traverse through many paths and experience Doppler shifts: These effects are similar to dynamic multipath reflections. Thus, Ox can be a relay node that introduces dynamically changing multipath components of the communication signal. In other words, Ox receives the incoming communication signal, manipulates the signals and forwards them back to the environment. To a legitimate receiver, this forwarded signal will simply look like a multipath component of the signal from the legitimate transmitter (Tx). Commercial off-the-shelf (COTS) Rx is capable of tolerating and even exploiting multipath reflections to decode data. Thus, a carefully designed Ox can distort sensing and still preserve communication. Challenges: PhyCloak works as a full-duplex amplify-and-forward (A&F) relay at logic layer, and an Ox at physical layer by distorting the 3 DoFs. While the solution may appear at first blush to be a simple instance of full-duplex A&F forwarder [6, 3], there are key challenges that arise from this design that need to be resolved.. Online self-channel estimation with an ongoing external transmission: Online self-channel estimation is needed for an Ox as it works in an environment where the channel is varying as a result of target movement, gestures and activities. When we combine the Ox module with a legitimate sensor the self-channel variation becomes more significant due to the moving object close to the sensor. Therefore an Ox has to transmit training symbols to acquire channel estimation every channel coherence interval ( ms). But a complication arises that the training needs to co-exist with ongoing data transmission. A straightforward way to overcome this problem is to adopt medium access control (MAC), however, that would introduce contention and hurt throughput of legitimate data transmission given the frequent self-channel updates. 2. Effectiveness of obfuscating physical information: No work has been done in validating a full-duplex A&F forwarder s capability of controlling physical information contained in the forwarded copy. In addition, the effectiveness of superposing an Ox s distorted signal and a target s reflected signal in obfuscating an eavesdropping sensor has yet to be shown. Contributions: We propose PhyCloak to protect privacy information from unwanted or even malicious sensing with no modification to existing wireless infrastructures. In this work, we make the following contributions:. To our knowledge, we are the first to address the potential threats due to the recent development of communication-based sensing. 2. We propose PhyCloak, the first full-duplex forwarderbased solution that hides physical information superimposed by the channel via adding interference in a 3- dimensional orthogonal basis so that illegitimate sensing is disabled and meanwhile data transmission is not affected (and even improved). We go further and add the capability to spoof human gestures to further confuse illegitimate sensors. 3. We propose an alternative online self-channel estimation scheme that is contention-free and operates in the presence of an ongoing transmission. By doing so we also allow for legitimate sensing by integrating the sensor with our obfuscator. 4. We build a prototype PhyCloak on PXIe-82, an SDR platform. Experimental results (Section 5.3) on a state-of-the-art sensor show that PhyCloak successfully obfuscates illegitimate sensing, enables legitimate sensing and improves overall throughput of data transmission. Gesture spoofing to the same type of sensor is also proved to be feasible. 2 Related Work RF sensing from communications has been of great interest in the last few years, as it allows data signals to be exploited to infer remarkable details about the physical world. Although the primary purpose of the communication signals is to carry logical information, concepts of radar analysis [4, 5, 23, 6, 5, 25, 27, 22, 9, 26,, 3, 7] are adapted to extract these details. There are however several challenges in the adaptation since communication signal is defined particularly for carrying data. For example, radar systems control their resolution by specially encoding their transmitting signals, say in the form of Frequency-Modulated Carrier Waves (FMCW) for spectrum sweeping, but when sensing from RF communication a similar sort of transmitter cooperation typically cannot be leveraged. As another example, 686 3th USENIX Symposium on Networked Systems Design and Implementation (NSDI 6) USENIX Association

4 Existing Work Feature Basis Device Sensing Task WiSEE: Pu et al. [24] Doppler Shift USRP-N2 Gesture recognition Wi-Vi: Adib and Katabi [] Phase USRP-N2 Gesture based communication,tracking E-eyes: Wang et al. [3] RSSI, CSI COTS 82.n devices Activity classification Gonzalez-Ruiz et al. [2] RSSI IEEE 82.g wireless card Obstacle mapping Wang et al. [29] Phase, CSI COTS 82.ac devices Activity classification WiKey: Ali et al. [2] CSI COTS 82.n devices Key recognition RSA: Zhu et al. [32] RSS HXI Gigalink 645 6GHz radios Object imaging sophisticated radar signal processing techniques, say creating a synthetic aperture using a large number of antennas, cannot be implemented directly in communication systems due to resource limitations. Many techniques have been developed and demonstrated to address the above mentioned challenges for diverse sensing tasks including motion tracking [], activity/gesture recognition [24, 3, 29], and obstacle/object mapping/imaging [32, 2], and even minor motions like keystrokes recognition [8, 2] and lip reading [28]. One idea is to use one antenna to emulate an antenna array in the presence of human movement. By tracking the angle of the reflected signal from the target (human) [], the system is able to track the motion of the target as a form of inverse synthetic aperture radar (ISAR). Ubicarse [8] exploits the idea of circular synthetic aperture radar (SAR), in which the system rotates a single antenna so as to emulate a circular antenna array. As SAR does not require the target to be in motion, unlike the case of ISAR, Ubicarse proposes a method of using a handheld device to create circular antenna array to perform localization. To overcome any imprecision in the circle created by the rotation, it refines the formulation of SAR by using the relative trajectory between two receive antennas. Some other techniques characterize signatures corresponding to the channel variation caused by human activities. E-eyes [3] shows that temporal RSS and CSI features, which are available in COTS devices, can be used in activity classification, albeit this requires relatively heavy training. WiSee [24] proposes a method to extract Doppler shifts from OFDM symbols by applying a large FFT over repeated symbols, and gesture recognition is then shown to be possible from the extracted Doppler shifts. Another interesting technique used by communication based sensors maps obstacles/objects [2, 2]. The Tx-Rx pairs detect the presence of obstacles via wireless measurements and thereby co-operatively draw the indoor obstacle map. As our protection system is single-input-single-output (SISO), we focus on breaking any SISO illegitimate sensing system in this work. Although SISO sensing systems use diverse techniques exemplified in Table, they all leverage a subset of the 3 DoFs discussed in Section. Since PhyCloak provides a generic tool to obfuscate in all these three dimensions, it can protect against any SISO sensor. Table : Summary of recent SISO sensing systems In contrast, for a multi-antenna sensing system, there is an additional DoF the relative placement of antennas that yields other types of information like angle of arrival (AoA) and time difference of arrival (TDoA). Nevertheless, by rotating PhyCloak s transmit antenna or extending our framework to a multi-antenna protection system, we would have the freedom to also obfuscate the fourth dimension provided by a multiantenna sensing system. 3 3 Overview 3. Threat Model Assume there is an adversary who is interested in inferring physical information from a SISO wireless communication channel. The adversary may be active or passive, i.e., it can transmit itself or just exploit ongoing wireless transmissions. In both cases, we assume that the adversary uses a single-antenna receiver to sniff the wireless transmission. In general, the design and implementation of adversarial sensing is unknown to the protection system designer. Note that some types of sensing require a training phase to tune recognition patterns with respect to the environment of interest. To protect against stronger adversaries, we assume that the adversary is well trained for the environment at hand. The details of this training, whether it occurs concurrently with the training of a legitimate sensor or is based on some historical knowledge, are outside the scope of our interest here. USENIX Association 3th USENIX Symposium on Networked Systems Design and Implementation (NSDI 6) 687 Alice Bob unprotected sensing Eve Ox II Carol Ox Sx protect Carol s sensing Figure : 4 single-input-single-output (SISO) nodes exist in the system: Alice, Bob, Carol and Eve: Alice and Bob perform data transmission and reception; Eve performs illegitimate sensing by exploiting Alice s transmission; Carol also performs sensing, but her obfuscator module forwards the received signal in a way that distorts physical information but preserves logical information

5 3.2 System and Goals Our protection system comprises 4 SISO nodes as shown in Figure : Alice (data transmitter), Bob (data receiver), Carol (legitimate sensor) and Eve (illegitimate sensor). Both Alice and Bob can be controlled by Eve, thus Carol does not assume that Alice and Bob are honest. Goals: 3 tasks co-exist in the network: data transmission between Alice and Bob, illegitimate sensing at Eve and legitimate sensing at Carol. By adding Ox to Carol with no cooperation from any of the other nodes, the protection system must satisfy the following three goals:. Obfuscate Eve s sensing. 2. Preserve Carol s sensing. 3. Not degrade the throughput of the link between Alice and Bob, nor introduce extra computation at Alice and Bob; i.e., Alice s and Bob s behaviors stay unaltered when Ox operates. 3.3 Three Degrees of Freedom Usually a forwarder relays the signal directly, but in the context of an Ox a forwarder can do far more. In fact, a forwarder can be viewed as a special type of reflector; in theory, whatever change a natural reflector can induce on a signal, a forwarder can induce likewise. We begin by examining how a reflector changes the signal. Letting the received signal at a reflector be s(t), the received signal r(t) that it reflects can be expressed as r(t)=a s(t) e j2π( f c+δ f )(t+δt) where a is the amplitude gain due to reflection and propagation, f c is the carrier frequency, Δ f is the Doppler shift caused by a reflector that moves at a constant speed relative to the receiver, and Δt is the delay due to propagation over the path. We see that a reflector modifies signals by changing three components: a, Δ f and Δt. Namely reflectors enjoy three DoFs when modifying signals. We examine what kind of signal processing is needed at the Ox to effect similar changes in the signal being forwarded. Rewrite Equation into the following form: r(t)=a s(t) e j2πδ ft e j2π( f c+δ f )Δt e j2π f ct Amplitude gain a: It is clear that if a forwarder receives s(t) from the source, then by amplifying the samples with different levels, a can be easily changed. Doppler shift Δ f : To emulate a Doppler shift of Δ f, a forwarder can rotate the nth received sample by 2πnΔ f Δt, where Δt = sampling interval. Delay Δt: A delay of Δt can be introduced by simply delaying the to-be-forwarded signals in either the digital domain or the analog domain at the forwarder. A problem with delaying signals in the digital domain is that digital delays are discrete and do not match the speed of human movement. For example, if an ADC works with () (2) a sampling rate MHz, then the minimum delay that can be introduced in digital domain is ns, which corresponds to a distance of 3m. Controlling analog delay while feasible, however requires effort in modifying existing SDR platforms. Our solution then is to rotate the to-be-forwarded samples by a fixed phase 2π( f c +Δ f )Δt in the digital domain, which matches the expected delay of Δt. In our NI PXIe platform, this calculation can be made in two clock cycles ( ADC sampling rate ). Frequency (Hz) (a) By multiplying the nth to-be-forwarded sample with 2πnΔ f Δt, and changing Δ f from 2Hz to -2Hz, the Doppler shift profile at the receiver is as expected Phase (b) By rotating the to-beforwarded signals with a certain phase which changes by 36 every 3ms at the forwarder, the phase of the signal changes 36 every 3ms Figure 2: Expected Doppler shift and phases are generated at a forwarder Figure 2(a) depicts the Doppler shift profile of the received signals that are sent by a forwarder who keeps changing the to-be-forwarded samples Doppler shift from 2Hz to -2Hz according to the above algorithm. Similarly, from Figure 2(b) we can see that by multiplying the to-be-forwarded samples with a phase ϕ which increases.2π every 3ms at the forwarder, the phase of the received samples changes by.2π every 3ms. These results show that a forwarder can predictably control Doppler shift and phase. 4 Design Figure 3 shows a simplified block diagram of our system PhyCloak. The physical distortion is introduced after self-interference cancellation and then the distorted signal is then forwarded to the transmit antenna. Tx Rx Analog cancellation Clean signals used for legitimate sensing Conventional fullduplex design Digital cancellation Physical distortion Figure 3: High-level block diagram of PhyCloak th USENIX Symposium on Networked Systems Design and Implementation (NSDI 6) USENIX Association

6 4. Online Maintenance of Self-Channel Estimates As mentioned earlier, PhyCloak is a full-duplex system that needs to cancel self-interference to operate. However, human movement close to the full-duplex radio changes the self channel and affects cancellation. Figure 4 illustrates this phenomenon as it depicts the power of the residual noise after cancellation over time when a human target walks around the fulld-uplex radio. The full-duplex radio re-estimates the channel every s. We see that if we set the residual threshold to -95dBm, which is 5 db above the maximum digital cancellation capability (noise = -dbm), the channel estimation works fine only for a short duration ( ms) after each channel estimation update. This observation implies that frequent self-channel re-tuning ( ms) is required. Residual noise (dbm) ms Power induced by training sequence every second 5ms 2 Time (s) 24ms Figure 4: With human movement going on, the selfinterference cancellatoin works fine only for a short duration ( ms) A complication, however, arises when an update is attempted during an ongoing external transmission: the external transmission may distort self-channel estimation while the transmission that helps with self-channel estimation may interfere with external data reception. There are two straightforward solutions to this problem: ) using MAC; 2) exploiting the silent period defined by wireless protocols, like short inter-frame space (SIFS) in WiFi. The former hurts the throughput of data transmission and moreover interrupted external transmission degrades coupling legitimate sensors with the Ox. And in addition, both of the solutions require a big effort to design careful adaptation to various wireless communication protocols. We therefore propose a self-channel estimation algorithm for PhyCloak that addresses this complication. It uses two main elements: ) oversampling and differential to get rid of any ongoing external transmission, and 2) a special training sequence that yields minimum interference to external transmissions. 4.. Self-channel estimation with and without external interference Before we describe our self-channel estimation algorithm, let us first see the impact of training with and without external interference. Assume A = {a m,a m+,...,a m } is the transmitted training sequence, B = {b,b,...,b m } is the received sample sequence, and H = {h,h,...,h m } is the channel coefficient vector in time domain with m + taps. Therefore, we have b a... a m h b a =... a m+ h (3) b m a m... a h m In the presence of external transmission, B becomes: b a... a m h b a =... a m+ h b m a m... a h m s... s m h s... s m+ h (4) s m... s h m where S = {s m,s m+,...,s i,...,s m } is the external transmitted sample sequence, and H = {h,h,...,h m} is the channel coefficient vector which corresponds to the channel between the transmit antenna of the external device and the receive antenna of the Ox Oversampling and differential to get rid of external interference To overcome the external interference in Equation 4, which is unknown to PhyCloak, we exploit oversampling. Say PhyCloak samples at a rate 2m times higher than the sampling rate of the external transmitter, it follows that approximately s m =...= s m. So s... s m h s (h h m) s... s m+ h s = (h h m) s m... s h m s (h h m) (5) Therefore, by differential we have b b a a... a m+ a m h b 2 b a = 2 a... a m+2 a m+ h b m b m a m a m... a a h m (6) It may appear that we have already been able to get rid of external interference, however, A is an m (m + ) matrix, so the rank of A is less than m +. This means that we can get only a unique solution for at most m USENIX Association 3th USENIX Symposium on Networked Systems Design and Implementation (NSDI 6) 689

7 of the m + unknowns contained in H, where H = {h,h,...,h m } T and A = a a... a m+ a m a 2 a... a m+2 a m a m a m... a a 4..3 A special training sequence To ensure that Equation 6 has a unique solution for {h,h,...,h m } T, we leverage a special training sequence, namely a square wave, which is shown in Figure 5(a). As shown in Figure 5(b), the fundamental frequency of the square wave is the square wave frequency, and its odd harmonics are decreasing in size. To be more specific, for a square wave over a period consisting of N samples with B MHz sample rate, the frequency components are at f,3f,..., (2i + ) f,... with decreasing amplitude, where f = B N MHz. Amplitude 2 Time (µs) Amplitude Frequency (MHz) (a) Training sequence in (b) Training sequence in frequency domain time domain Figure 5: Training sequence The rationale for using this training sequence is twofold: First, the square wave has a unique solution to {h,h,..., h m } T as long as a m = a m+ =... = a = a + c =... = a m + c, where c is a non-zero constant. And second, the spikes it produces in the frequency domain are sparse. For example, with B = MHz and N = 6, the space between neighboring spikes is 2.5MHz. Such sparse spikes are tolerable in wireless systems. For example, in a 2MHz WiFi band using OFDM, as claimed by Flashback [9], existing WiFi systems have a relatively large SNR margin. And because the interference of any such spike is constrained to at most one subcarrier, the loss of a few bits does not significantly affect decoding, as successful packet transmissions always respect SNR margins The training procedure Training is performed as follows: PhyCloak samples at a rate n times higher than that of external transmission. A training sequence which is the concatenation of consecutive s and -s is sent during training. The received samples corresponding to the transition points ( to - (7) Amplitude M 4M 3M 2M M Channel Taps Figure 6: Channel coefficients measured at different sampling rates or vice versa) are used to calculate the channel coefficients. More specifically, the received sample b which corresponds to the point right before the transition occurs is equal to h + + h m, and the next received sample b is equal to h + + h m. Thus, we can compute h =(b b)/2. The rest of the channel coefficients are calculated in a similar way. One concern is whether the desired oversampling rate can be supported. Take 82.g as an instance, which has the smallest bandwidth (2MHz) among WiFi standards. If training were to require a 2X oversampling rate, we would need a platform that supports 4MHz sampling rate, which is very expensive. We figure out that, however, a 4X oversampling rate is sufficient to eliminate the effect of an external transmission of 82.g. The reason is that the delay spread of non-ultra-wideband transmission in an indoor setting does not expand more than 3 taps. To understand that, we need to know the fact that power delay profile is decided by two factors: multipath propagation and inter-symbol-interference (ISI). Let us study them one by one. First is the multipath propagation. For a 2MHz radio, one tap corresponds to 3 8 m/s 2MHz = 5m. So the fourth tap corresponds to a 6- meter reflective path. The power conveyed by the 6- meter reflective path is significantly smaller than that conveyed by the short ( cm) line-of-sight path between the co-located transmitting and receiving antennas. Second, due to ISI each received sample is affected by not only the intended transmitted symbol, but also its two neighboring symbols. Therefore the delay spread expands across 3 taps. Figure 6 plots the channel estimation of the self channel under different sampling rates in the same environment. We see that in all cases, the main energy is always spread across 3 taps. So as long as we can accurately estimate the three dominant taps in non-ultra-wideband, we can achieve good cancellation performance. That implies we need the external interference to be stable during the reception of at least four consecutive samples at the transition point of the training sequence so as to get the three main taps by differential. Namely 4X oversampling is required. Note that 4X oversampling does not guarantee the re- 69 3th USENIX Symposium on Networked Systems Design and Implementation (NSDI 6) USENIX Association

8 - 2 Frequency (Hz) (a) s Frequency (Hz) (b).5s Frequency (Hz) (c).25s - 2 Frequency (Hz) (d).5s Figure 7: The granularity of the spectral decreases as the Doppler shifts change from s to.5s ception of the desired 4 samples happen in the duration of one external interference sample. But we can leverage the interference reduction provided by averaging over multiple transition points, and partially accurate estimation of the channel taps, and still achieve good performance. Even lower oversampling rate (2X/3X) also performs well according to the experiment (see Section 5.2) Doppler shift obfuscation 4.2 Obfuscation of Patterns in 3 DoFs To motivate how we obfuscate patterns in the three DoFs, let us first examine the result of superposing a signal via one path with an obfuscated version via another path. Assume we have two paths: one with {a,δ f,δt }, and the other via the Ox with {a 2,Δ f 2,Δt 2 }. The superposition of the signals through these two paths is given by the following formula: ˆr(t)=a s(t) e j2π( f c+δ f )(t+δt ) + a 2 s(t) e j2π( f c+δ f 2 )(t+δt 2 ) Now, is superposing an obfuscated signal sufficient for hiding the original triplet {a,δ f,δt }? The answer is partially yes: The amplitudes and delays are instantaneously covered in the superposed signal, but the respective Doppler shifts remain distinguishable after superposition. So, a and Δt can be hidden instantly by randomly changing amplitude and delay of the signal by the Ox. To see why Doppler shifts are distinct even after superposition, consider the frequency response of the received signals: R( f )= ˆr(t)e 2π jft dt = (a s(t) e j2π( f c+δ f )(t+δt ) )e j2π ft dt + (a 2 s(t) e j2π( f c+δ f 2 )(t+δt 2 ) )e j2π ft (9) dt =a e j2π( f c+δ f )Δt S( f fc Δ f ) + a 2 e j2π( f c+δ f 2 )Δt 2 S( f fc Δ f 2 ) where S( f ) is the frequency response of s(t). In an OFDM system, we can see two frequency components that are shifted by Δ f and Δ f 2 around the subcarrier f. In theory for a high sampling rate receiver, delays might be separable in the brief prefix that arrives before the obsfuscated signal arrives, but how much information a sensor can accurately extract from the brief clean prefix is questionable. (8) As amplitude and delay can be instantly changed by superposition with an obfuscated signal, patterns that rely only on amplitude and delay can be hidden by Ox, by randomly changing them on a per packet basis. At first glance, it may appear that this scheme cannot be made to work for patterns that rely on Doppler shift, but it turns out the scheme can be made to work for Doppler shift, assuming the moments of change are carefully chosen. The rationale for choosing the moments of change is based on the fact that a t-second observation in the time domain leads to /t Hz granularity in the frequency domain. To choose the appropriate Δ f at /t Hz granularity, there is an implicit requirement that the Δ f needs to last for at least t seconds. Therefore, if the forwarder changes its Δ f every t seconds while the other copy s Δ f does not change, an observer would still only see /t Hz granularity. Since human movements typically result in -2Hz to 2Hz Doppler shifts in the 2.4GHz band, a Doppler shift of the forwarded copy that changes every.s creates sufficient confusion at an observer. Figure 7 shows that when the Doppler shifts of the transmitted signals are varied from every s to every.5s, the spectral seen by an observer with s observation interval have progressively finer granularity, to the point where a time-frequency pattern gets hidden Effect of superposing with randomly changing obfuscated signals The basic idea of PhyCloak then is to superpose signals from the target with naturally changing {a,δ f,δφ} with the obfuscated signals with randomly changing {a,δ f,δφ}. More specifically, as analyzed above, Phy- Cloak changes the value of the triple every.s. We illustrate the blackbox effect of obfuscation experimentally using two state-of-the-art sensors, WiSee [24] and Wi- Vi [], which we implemented. WiSee performs gesture recognition by extracting Doppler shifts from OFDM symbols, whereas Wi-Vi uses ISAR to track the angle of human motion with respect to the receive antenna of the sensor. For the case of obfuscating Doppler shift patterns, Figure 8 shows the superposition of a signal with the syn USENIX Association 3th USENIX Symposium on Networked Systems Design and Implementation (NSDI 6) 69

9 Frequency (Hz) (a) db Frequency (Hz) (b) -3dB Frequency (Hz) (c) -6dB - 2 Frequency (Hz) (d) -9dB Figure 8: The pattern that a WiSee sensor sees in Figures 2(a) is hidden by an obfuscated signal where Doppler shift changes every. second - - / (a) Motion towards a Wi-Vi style sensor with constant angle / (b) db / (c) -3dB / (d) -6dB Figure 9: The constant angle of human motion (starting from 9th second) that a Wi-Vi style sensor sees in (a) is hidden by an obfuscated signal where phase changes randomly every. second thetically generated Doppler shift pattern described in Figure 2(a) and an obfuscated copy of the pattern where Doppler shift changes randomly every.s. We see that pattern of Figure 2(a) is covered by the noise map created by the randomly changing copy. As the strength ratio of the former relative to the latter, which we define as signal to obfuscation ratio (SOR), decreases from db to -9dB, the visibility of the artificial pattern decreases. For the case of obfuscating phase-based patterns, we synthetically emulated a human moving towards the receive antenna of our Wi-Vi style sensor at a constant angle, as shown in Figure 9(a), and then superposed the signal with a randomly obfuscated copy where phase changes every.s. Figure 9 shows that as SOR decreases from db to -6dB, the pattern shown in Figure 9(a) becomes progressively invisible at the Wi-Vi style sensor. It is worth noting that power passively reflected by human is much smaller compared to that actively forwarded by an Ox that has its own power supply. Therefore db SOR can be readily achieved. To illustrate this point, we can build a simplified power model of our system. In our system Ox s goal is to minimize SOR at Eve with no knowledge of the locations of any of the other parties, so its best strategy is to work at the maximum transmission power. If we assume free-space attenuation, then SOR A a ( d 3d 4 d d 2 ) 2, where a and A are the reflection gains at target and Ox respectively, and d,d 2,d 3 and d 4 are the distances as shown in Figure (a). Figure (b) plots the simulation result of the CDF of SOR when we randomly place Alice, Eve, Ox and human target in a m 5m room, with reflection gains being set to -3dB CDF Alice Ox (a) Placement of all the involved parties.8 88% SOR (db) 2 4 (b) SOR distribution Figure : A simplified power model and db respectively. We see that in around 88% cases, SOR is smaller than db Security analysis We believe that our system is robust against a single antenna eavesdropper given certain SOR because of the fact: little information can be extracted from two random signals which occupy similar bands as long as the power of the undesired signal is higher than that of the desired one. In our case, the desired signal is the natural channel variation induced by target, while the undesired one is the artificial channel variation induced by PhyCloak. It is worth noting that as human motion is slow, natural channel variation has a small bandwidth, which is comparable to that of the artificial channel variation that changes ev- Eve th USENIX Symposium on Networked Systems Design and Implementation (NSDI 6) USENIX Association

10 RSSI (db) 2 Time (second) (a) RSSI variation caused by human motion Power (db) 4 2 RSSI (db) 2 Time (second) (b) RSSI variation caused by Ox Power (db) 4 2 about the features and algorithms used by the sensor. For example, if an Ox knows a sensor uses the WiSee algorithm [24], it can create a Doppler shift profile accordingly without making an effort to model accurate human movement. Figure 2 depicts the extracted Doppler profile of a human gesture (pull) and that spoofed by an Ox. WiSee segments a Doppler profile into positive and negative parts according to its power distribution and encodes them into s and -s respectively. Since both of the profiles contain positive Doppler shifts of negligible power, they will be encoded as -s and mapped to the same target by a WiSee sensor. 2 2 Frequency (Hz) 2 2 Frequency (Hz) (c) Power spectrum of the (d) Power spectrum of the RSSI trace in (a) RSSI trace in (b) Figure : The signal (real channel state information) and the noise (artificial channel state information) have similar bandwidths ery.s. To illustrate the above point, we compare the RSSI variations induced by human and PhyCloak. Figure (a) and (b) plot the RSSI changes caused by human movement and PhyCloak respectively, and Figure (c) and (d) plot the corresponding power spectrums. From the figure, we see that the occupied bandwidths of the two channel state traces are similar. Frequency (Hz) (a) Doppler shifts created by a human gesture (pull) Frequency (Hz) 2 Figure 2: Spoofing 4.3 Spoofing (b) Doppler shifts emulated by an Ox According to the above discussion, our design succeeds in obfuscating any RF-based single-antenna sensors by creating false negative results. But an Ox can achieve more than that: it can create false positives also by spoofing changes in the 3 DoFs that are similar to the changes created by a target. By splitting the to-be-forwarded samples into multiple streams, applying different instantiations of the triple {a,δ f,δt} to them, and forwarding the combination of the processed streams as one stream, an Ox can emulate multiple reflectors corresponding to different parts of the target (say a human body). But unlike the case of false negatives, the effectiveness of creating false positives at a sensor grows as the Ox knows more 4.4 PhyCloak By obfuscating using random physical distortion, an Ox is able to confuse Eve, and by online maintenance of selfchannel estimates, Ox is able to output interference-free signals to Carol for legitimate sensing. However, one critical requirement is still not met: preserving the communication throughput in the presence of Ox. Although PhyCloak works as a relay at logical layer which can potentially improve the throughput [3], it is not clear that obfuscation would not hurt the decoding process. We find that, however, as long as the change of the triplet {a,δ f,δφ} does not happen in the middle of packet transmission, obfuscation is safe with respect to data communication. The reason for this is that from the perspective of a data receiver, the Ox effectively just adds variability to the channel. Since data receivers usually perform channel estimation at the beginning of the received packet, as long as the channel is stable during the reception of the packet, decoding can be successful. We, therefore, refine the design of Phy- Cloak as follows: PhyCloak switches between two transmitting modes: training and forwarding. In the training phase, the PhyCloak sends the above mentioned training sequence and computes its self-channel estimate according to Section 4..4; in the forwarding phase, PhyCloak then performs self-interference cancellation, applies the physical distortion {a,δ f,δφ} to the interference-free signal and forwards the distorted signal via the transmit antenna. The PhyCloak randomly chooses an instance of {a,δ f,δφ} in the predefined pool and updates the current value when the channel is free and the last update happened more than.s ago. In this way, PhyCloak avoids interfering with the transmission. And in theory, there is still a chance that due to the delay caused by free-channel detection, PhyCloak changes the channel after several samples of a packet has been transmitted, but that chance is quite low. Even if it happens, because PhyCloak only affects a few samples at the beginning, the packet might still be decodable. USENIX Association 3th USENIX Symposium on Networked Systems Design and Implementation (NSDI 6) 693

11 5 Validation We now describe a prototype of PhyCloak that we have built, and our experiments to validate its performance. 5. Experimental Setup Our prototype is based on PXIe 82 SDR platform. We built the transmitter, receiver, eavesdropping sensor and legitimate sensor on the same platform, which all follow the 82.g standard, i.e., working at 2.4GHz with a 2MHz band. PhyCloak works at the same center frequency but with a 5MHz sampling rate, about 3 times the rate of an external data transmission, which gives it a reasonable margin to perform self-channel estimation with an ongoing external transmission (see Section 5.2). PhyCloak contains two RF chains, one for transmitting and one for receiving. Each of the RF chains contains an NI-579 (FlexRIO RF transceiver equipped with one antenna) for transmitting or receiving and an NI PXIe-7965R (a Xilinx Virtex-5 FPGA) for digital processing. Analog cancellation is implemented according to our earlier design [7, 4]. The self-channel estimation, digital cancellation and physical layer distortion are implemented on the FPGA. The distortion processing introduces a latency of about ns. Our experiments were conducted in a 5m 7m lab. 5.2 Self-Interference Cancellation Cancellation(dB) Ref Oversampling Rate (a) Cancellation performance of square-wave based training increases when oversampling rate increases from to 4 Power (db) Before Cancellation External Transmission After Cancellation Time (s) (b) Insensitivity of square-wave based training to external transmission power variation, which is necessary for preserving legitimate amplitude based sensing Figure 3: Self-interference cancellation performance We begin with the performance of the digital cancellation of our self-channel estimation algorithm. As discussed in Section 4..4, Ox tolerates external interference during self-channel estimation using oversampling. So, we first examine the oversampling rate needed to achieve reasonably accurate self-channel estimates in the presence of external transmission. We let a full-duplex transceiver operate at 5MHz with a -tap filter for selfinterference (digital) cancellation. Self-channel estimation is obtained by averaging over 28 training rounds, which altogether takes about 2μs. Figure 3(a) plots the self-interference cancellation performance of our square-wave based training. In the figure, as we fixed the sampling rate of the full-duplex radio (5MHz), different oversampling rates correspond to different external transmission rates with the received power of the external transmissions being the same as that of self-interference signal at Ox s receive antenna 2. X oversampling rate corresponds to the case when the training and data communication use the same sampling rate, in which case square-wave based training and traditional pilot based training would achieve similar performance. We see that the performance of self-interference cancellation of square-wave based training gets better as the oversampling rate increases from to 4, but it stops increasing after 4, and achieves similar performance as that in the case when there is no external transmission going on (indicated by the red bar). It shows that Ox can reliably estimate and cancel self-interference even in the presence of strong external transmission when the oversampling parameter is 4X as supported by our observation in Section 4.. In addition, 2X and 3X oversampling rates also produce high cancellation as they benefit from two factors: ) accurate estimation of part of the channel taps, and 2) averaging over multiple transition points. Takeaway: Our oversampling technique makes self-interference cancellation reliable at modest oversampling rates even in the presence of strong ongoing external transmission. The analysis above considers external interference sent at a fixed power. To enable legitimate sensing, selfinterference cancellation performance needs to be stable even when the received power from external transmission is varying. For example, an unstable selfinterference canceler can render an amplitude-based sensor useless since the (varying) residual self-interference will affect the received signal amplitude. Figure 3(b) plots the full-duplex radio s cancellation performance with 3X oversampling rate over time during which the received power from the external transmitter fluctuates. We see that the self-interference cancellation performance of square-wave based training is insensitive to the variation of external interference. Takeaway: Our oversampling technique results in a stable cancellation performance at 2 Note that this is a very strong external interference and we choose this setting to show oversampling strategy s performance even under strong external interference th USENIX Symposium on Networked Systems Design and Implementation (NSDI 6) USENIX Association

12 modest oversampling rates even when the received signal from external transmitter is varying. 5.3 Obfuscation Performance 5.3. Obfuscation vs. SOR in 3 DoFs We first measure the different levels of obfuscation created by PhyCloak by comparing the correlation of the amplitude, phase and Doppler shift with and without the presence of PhyCloak. The transmitter is programmed to send continuous OFDM symbols with QPSK modulation with varying amplitude and phase. An artificial Doppler shift of Hz is also added at the transmitter. PhyCloak performs obfuscation by randomly changing the amplitude, phase and Doppler shifts every.s. Correlation Doppler Shift Amplitude Phase SOR (db) Figure 4: Obfuscation level of each of the three features decreases as SOR (original signal over obfuscation signal) increases Figure 4 depicts the correlation between the pairs of amplitude, phase, and Doppler shifts at different SORs: Again, SOR is the signal strength ratio of original signal over obfuscation signal (see Section 4.2.2). We see that as SOR increases, the correlation of each pair of the three features increases, i.e., the obfuscation degree decreases. Amplitude sequence pair and phase sequence pair see lower correlation than Doppler shift pair when SOR is high. This is because amplitude and phase are instantaneous quantities, while Doppler is a statistical quantity that is derived from multiple instantaneous samples. But, even for Doppler shift, a db SOR is low enough to hide the patterns contained in signals reflected by targets. It s worth noting that in practice, as PhyCloak is independently powered while the target only passively reflects signals, the desired SOR to successfully obfuscate is readily achieved. Takeaway: PhyCloak effectively obfuscates sensing even at a relatively high SOR. As different sensors differ in their robustness to noise, PhyCloak s effectiveness is sensor dependent. While we are unaware of any research on the robustness of the communication-based sensors, we may infer from Figures 8, 9 and 4 that less obfuscation power is needed to confuse a phase or amplitude based sensor as compared to a Doppler shift based sensor. Therefore, we choose to validate the PhyCloak s capability of confusing illegitimate sensing and preserving legitimate sensing in the context of WiSee, which is the state-of-the-art Doppler shift based sensor Degradation of illegitimate sensing We built a Doppler-based sensor in our platform per the method proposed by WiSee [24]. The method consists of two parts: ) extraction of Doppler shifts from repeated OFDM symbols by applying a large size FFT; and 2) using sequence matching to classify gestures. We note since we could not get to the original WiSee code and some of the details are missing, we implement WiSee with a few adaptations. For example, we randomly map the sequence to the predefined classes with uniform distribution in case the sequence does not match any of the predefined sequence. Our implementation shows a classification accuracy of 93% across 5 gestures in noneline-of-sight (NLoS) setting with the human target 5 feet away from the WiSee sensor, while WiSee reports 94% across 9 gestures. While there is this small discrepancy in replication, the core algorithm is the same and our main goal is to study obfuscation performance. We examine the performance of an illegitimate WiSee sensor with obfuscation from a PhyCloak. We conduct two sets of experiments to validate PhyCloak s coverage range and its overall effectiveness under different channel conditions respectively. Obfuscation coverage: First, we randomly choose pairs of locations to place Tx and Eve, and then place Ox in locations such that the distance d TE between Tx and Eve is equal to the distance d TO between Tx and Ox as shown in Figure 5(a), but the distance d EO between Eve and Ox varies from.5d TE to 2d TE. The channels between any two of the three parties are lineof-sight (LoS). 3 A human target performs five gestures drag, push, pull, circle and dodge close to Eve. With no obfuscation, Eve s classification accuracy in this placement is about 9% across the five gestures. For simplicity, we normalize d EO by d TO (d TE ), and plot the classification accuracy against the normalized d EO in Figure 5(b). As we know, the received obfuscation power at Eve from Ox is a function of d TO and d OE, therefore as d EO increases the power ratio of obfuscation over human reflection decreases. From the figure we see that classification accuracy of Eve increases as d EO increases as expected. Note that since we have 5 classes, 3 WiSEE sensors have a slightly worse performance in LoS ( 9%) than NLoS ( 93%) as strong direct power from the transmitter hides the information provided by target s reflection. For the next two experiments, we choose LoS instead of NLoS because it makes the placement easier to make sure d EO is the only variable which would change the power ratio of the obfuscation and human reflection. USENIX Association 3th USENIX Symposium on Networked Systems Design and Implementation (NSDI 6) 695

13 a classification accuracy of.2 means a random guess. PhyCloak can obfuscate Eve near perfectly when d EO is smaller than.8, and it totally fails when it is larger than.7. Takeaway: The closer Ox is to Eve, the better the achieved obfuscation. Eve Tx x (a) Placement of Tx, Ox and Eve with all three channels LoS Accuracy (b) Classification accuracy of Eve in the presence of PhyCloak increases as d EO increases Figure 5: Eve s classification accuracy vs d EO Eve x Tx (a) Placement of Tx, Ox and Eve with all three channels LoS. Accuracy (b) Classification accuracy of Eve in the presence of PhyCloak increases as d TO increases Figure 6: Eve s classification accuracy vs d TO In the second experiment, we make d TE = d OE, and vary d TO as shown in Figure 6(a). And again in Figure 6(b), we see that as d TO increases, Eve s classification accuracy increases. Takeaway: the closer Ox is to Tx, the better obfuscation is achieved. In other experiments we vary either the human-eve or human-ox distance while keeping the power received by Ox and human from Tx stay constant. As these distances respectively reduced, the effectiveness of the sensing and obfuscation respectively increased. Eve Tx human LoS Ox LoS (a) Example of LoS/LoS placement in the lab Accuracy no ox NLoS/NLoS LoS/NLoS NLoS/LoS LoS/LoS Channel Condition (b) Obfuscation degrades somewhat if Tx-Ox or Ox-Eve channels are NLoS Figure 7: Eve s classification accuracy under different Tx-Ox and Ox-Eve channel conditions Obfuscation effectiveness under different channel conditions: In addition to the coverage range in LoS setting, we also measure Eve s classification accuracy when channels between the transmitter and obfuscator and the channel between the obfuscator and Eve are under different LoS and NLoS combinations. Intuitively, when both channels are NLoS, Eve receives the least power forwarded by the obfuscator, and therefore, she achieves the best performance. We care about these channel conditions because in some scenarios the transmitter is under control of the adversary, and therefore the adversary may enjoy the freedom to create good channels to mitigate PhyCloak s obfuscation. In the experiment, we make the channel between Tx and Eve NLoS, and the channel between Tx and the human and that between human and Eve LOS, so as to make sure Eve sees high classification accuracy when no obfuscation is going on. The channel between Tx and Ox and the channel between Ox and Eve have four possible channel condition combinations. A human target performs 5 times of the 5 predefined gestures near Eve in each of the four combinations. Figure 7(a) is an example of how we create a channel combination of Los/Los in the lab, where the first LoS refers to the channel condition of the channel between Tx and Ox, while the second refers to that of the channel between Ox and Eve. NLoS channels are created by placing obstacles in the direct propagation paths. Figure 7(b) depicts Eve s classification accuracy without obfuscator and with obfuscator in four channel combinations. We can see that as expected, Eve sees the highest classification accuracy (65%) in NLoS/NLoS setting among the four channel conditions, but it is still smaller than the case when no obfuscation is happening (93%). Eve sees similar performance in Los/NLoS and NLoS/LoS scenarios as power forwarded by obfuscator in both the settings is similar. Takeaway: although NLoS channel degrades the received power at Eve from Ox, the degradation is not dramatic since there is rich multipath propagation in indoor environment. drag push pull circle dodge drag spoof push spoof pull spoof circle spoof dodge spoof Figure 8: False positives with a spoofing Ox Feasibility of spoofing We built a spoofing obfuscator by reverse engineering the five predefined sequences corresponding to the five gesture types that our WiSee sensor recognizes. The basic difference between this spoofing obfuscator and Phy- Cloak is that the former changes Doppler shift according to the five well-defined gestures, while the latter changes 696 3th USENIX Symposium on Networked Systems Design and Implementation (NSDI 6) USENIX Association